Mobile phones, tablets and vendor support

Phones and tablets are in scope for Cyber Essentials when they access organisational data or services, such as work email, Teams, files or business apps. That includes staff-owned phones. Each one must run an operating system version that its vendor still supports with security updates, and those updates must be installed within 14 days. For Android, what matters is whether the manufacturer still sends security updates to that model, not just which Android version it runs.

Which mobile devices are in scope

• Organisation-owned phones and tablets that reach work data or services.
• Personal phones and tablets (BYOD) used for work email, apps or files.
• Out of scope: devices used only for native calls, native text messages or an MFA app.

In the scope section, list phones and tablets with make and operating system version, for example "15 Apple iPhone, iOS 27; 6 Samsung Galaxy, Android 16".

Apple iPhone and iPad

Apple supports iOS and iPadOS versions without publishing end dates. IASME's Knowledge Hub lists which versions it treats as supported. Each Apple security release starts a 14-day clock. See Apple devices and updates.

Android: the model matters

Google publishes monthly Android Security Bulletins. These say which Android versions still receive fixes. But the fixes reach your phone only when its manufacturer, such as Samsung, Google, Motorola or Nokia, builds and releases an update for that model. Two phones on the same Android version can have very different support status.

To check an Android device:

1. Find the manufacturer's support end date for the model. Google publishes update periods for Pixel phones. Samsung publishes which models get monthly, quarterly or biannual security updates.
2. Check the security patch level. Open Settings and look under security or about phone. The patch level is a date. If it is many months old and no update is offered, the device has probably stopped receiving updates.
3. Check the Android version is still covered by the security bulletins.
4. Turn on automatic system updates where the manufacturer offers them.

A phone can be past the end of Android version upgrades and still be supported, as long as it still receives security updates. The phase that matters for Cyber Essentials is security updates.

In the UK, the PSTI product security regime has, since April 2024, required makers of consumer connectable products, including phones, to publish the minimum period for which they will provide security updates. That statement is a useful place to start when checking a newer model.

IASME's question set gives Android 12 and iOS 15 as examples of mobile operating systems that are out of regular support.

Updates on phones and tablets

The 14-day rule applies to mobile operating systems and apps. Practical steps:

• turn on automatic updates for the operating system and for apps from the app store
• for managed devices, use MDM to report versions and set update deadlines
• for BYOD, say in your policy that staff must install updates promptly, and check, for example through conditional access rules that block out-of-date devices

Malware protection on mobiles

Phones and tablets normally meet the malware control through application allow listing: apps come only from the official app store, from an approved list, and devices must not be jailbroken or rooted, so unsigned apps cannot be installed. See answering the malware questions.

Device locking

If a PIN only unlocks the device, it must be at least 6 characters. Use the vendor's lockout after repeated wrong attempts.

If a device is no longer supported

• Replace it with a supported model.
• Stop it accessing organisational data or services, which takes it out of scope. Removing the work email account and work apps is usually enough for a personal phone, but make sure access is actually blocked.
• Keep it for calls, texts or an MFA app only.

Read more in personal devices and the supported software rule. The readiness checker asks about mobile devices before you start.